V4L/DVB (10254): em28xx: Fix audio URB transfer buffer race condition

em28xx: Fix audio URB transfer buffer memory leak and race
condition/corruption of capture pointer

Leak fix kindly contributed by Pádraig Brady.

Signed-off-by: Robert Krakora <rob.krakora@messagenetsystems.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

drivers/media/video/em28xx/em28xx-audio.c

@@ -65,6 +65,9 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
 		usb_unlink_urb(dev->adev.urb[i]);
 		usb_free_urb(dev->adev.urb[i]);
 		dev->adev.urb[i] = NULL;
+
+	       kfree(dev->adev.transfer_buffer[i]);
+	       dev->adev.transfer_buffer[i] = NULL;
 	}
 
 	return 0;
@@ -389,11 +392,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream,
 static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream
 						    *substream)
 {
-	struct em28xx *dev;
+       unsigned long flags;
 
+	struct em28xx *dev;
 	snd_pcm_uframes_t hwptr_done;
+
 	dev = snd_pcm_substream_chip(substream);
+       spin_lock_irqsave(&dev->adev.slock, flags);
 	hwptr_done = dev->adev.hwptr_done_capture;
+       spin_unlock_irqrestore(&dev->adev.slock, flags);
 
 	return hwptr_done;
 }